security: add |esc_url to all template URLs, register escape Twig filters (v1.1.3)

5th OWASP Top-10 pass: added |esc_url filter to all unescaped URL outputs
across 8 Twig template partials (headers, footers, search, comments).
Registered esc_html, esc_attr, esc_url as Twig filters with is_safe option.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

views/partials/comment-item.html.twig

@@ -7,8 +7,7 @@
         <div class="d-flex align-items-center gap-2 mb-1">
             <strong class="small">
                 {% if comment.author_url %}
-                    {# author_url is pre-escaped with esc_url() in ContextBuilder #}
-                    <a href="{{ comment.author_url|raw }}" class="text-decoration-none text-body" rel="nofollow">
+                    <a href="{{ comment.author_url|esc_url }}" class="text-decoration-none text-body" rel="nofollow">
                         {{ comment.author }}
                     </a>
                 {% else %}
@@ -19,7 +18,7 @@
                 {{ comment.date }}
             </time>
             {% if comment.edit_url %}
-                <a href="{{ comment.edit_url }}" class="text-body-secondary small">{{ __('Edit') }}</a>
+                <a href="{{ comment.edit_url|esc_url }}" class="text-body-secondary small">{{ __('Edit') }}</a>
             {% endif %}
         </div>
         <div class="comment-content small">